Digital Certificate Trust Path Computation Using Transitive Closures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity and cost associated with managing trust paths for digital certificates in public key infrastructure (PKI) technologies hinder their widespread deployment, particularly due to the need for frequent validation of certificates between entities during secure transactions.
Innovation Solution
The method involves representing hierarchical certifications and peer-to-peer cross-certifications using trust relations, generating trust path information through transitive closure and 'all pairs shortest paths' computations, and incrementally updating these as trust relations change, with computations delegated to a central agent in a trust web.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If trust paths are constructed for each validation event, then certificate validation can be performed, but administrative complexity and processing costs increase significantly
Solution Approach 1:
The patent pre-computes transitive closure of trust relationships and stores them in a lookup table before validation events occur. This preliminary action eliminates the need to construct trust paths during each validation, reducing administrative complexity while maintaining validation reliability
Solution Approach 2:
The patent prepares trust path information in advance by computing transitive closure and storing it in a lookup table. This beforehand cushioning provides ready-to-use validation data, cushioning against the complexity that would arise during actual validation events
2Reliability
If trust paths are constructed for each validation event, then certificate validation can be performed, but computational resources and time are consumed repeatedly
Solution Approach 1:
The patent pre-computes transitive closure of trust relationships and stores them in a lookup table before validation events occur. This preliminary action eliminates the need to construct trust paths during each validation, reducing administrative complexity while maintaining validation reliability
Solution Approach 2:
The patent creates a copy of trust relationship data in a lookup table that can be quickly queried. Instead of repeatedly computing trust paths, the system copies pre-computed results into an accessible format, dramatically reducing validation time
3Productivity
If certificates are published immediately to public repository, then availability for security services is improved, but trust path management complexity increases
Solution Approach 1:
The patent enables the system to automatically maintain and query trust relationships using pre-computed transitive closure data. The lookup table allows certificates to be immediately available while the system self-manages trust path validation without requiring complex administrative intervention
Data Source
AI summary
A method, system, apparatus, and computer program product are presented for managing digital certificates. When entities need to engage in a secure transaction or open a secure communication link, they may exchange digital certificates in order to provide a public key or reference information to a public key for the opposing entity, thereby requiring validation of a received certificate. Rather than construct a trust path for each validation event, hierarchical certifications and peer-to-peer cross-certifications among a set of certificate authorities are represented by a set of trust relations, and trust path information is generated using a transitive closure computation and an “all pairs shortest paths” computation over the set of trust relations and then incrementally updated as the set of trust relations changes. Computations related to trust paths can be delegated to a central agent in a trust web.